CVE-2005-0241
NoneCVSS
—
EPSS
69.7%
Published
May 2, 2005
CISA due date
—
The record
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | squid | 0 | 2.5.7-7 |
| Debian:12 | squid | 0 | 2.5.7-7 |
| Debian:13 | squid | 0 | 2.5.7-7 |
| Red Hat:enterprise_linux:3::as | squid | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::as | squid-debuginfo | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::desktop | squid | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::desktop | squid-debuginfo | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::es | squid | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::es | squid-debuginfo | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::ws | squid | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:3::ws | squid-debuginfo | 0 | 7:2.5.STABLE3-6.3E.7 |
| Red Hat:enterprise_linux:4::as | squid | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::as | squid-debuginfo | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::desktop | squid | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::desktop | squid-debuginfo | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::es | squid | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::es | squid-debuginfo | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::ws | squid | 0 | 7:2.5.STABLE6-3.4E.3 |
| Red Hat:enterprise_linux:4::ws | squid-debuginfo | 0 | 7:2.5.STABLE6-3.4E.3 |
Related vulnerabilities
- CVE-2025-54574 Squid is a caching proxy for the Web. Also affects squid
- CVE-2024-45802 Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Also affects squid
- CVE-2024-25111 Squid is a web proxy cache. Also affects squid
- CVE-2016-4554 mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended… Also affects squid
- CVE-2016-4051 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9… Also affects squid
- CVE-2016-2390 The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x… Also affects squid
- CVE-2016-3948 Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which… Also affects squid
- CVE-2016-3947 Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger… Also affects squid